CVE-2026-85107
Last modified
CVE-2026-85107 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process.
Description
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| NousResearch | hermes-agent | 0.18.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-85107?
How severe is CVE-2026-85107?
How do I fix CVE-2026-85107?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-85093Cheshire Cat AI's GET /memory/collections/{collection_id}/po…6.5
- CVE-2026-85094The Canva Android App before 2.376.0 did not restrict the h…8.8
- CVE-2026-8510Integer overflow in Skia in Google Chrome on Windows prior t…7.5
- CVE-2026-85100A vulnerability was detected in 2FastLabs agent-squad up to …4.3
- CVE-2026-85105A flaw has been found in NousResearch hermes-agent 0.18.0. A…7.3
- CVE-2026-85106A vulnerability has been found in NousResearch hermes-agent …6.3
- CVE-2026-85109A vulnerability was determined in Tenda HG10 300001138. This…9.8
- CVE-2026-8511Use after free in UI in Google Chrome prior to 148.0.7778.16…9.6
- CVE-2026-85110A vulnerability was identified in Tenda HG10 300001138. Impa…8.8
- CVE-2026-8512Use after free in FileSystem in Google Chrome prior to 148.0…8.3
- CVE-2026-85124@fastify/http-proxy versions before 11.6.2 do not validate p…7.5
- CVE-2026-8513Use after free in Input in Google Chrome on Android prior to…8.3
Are you affected by CVE-2026-85107?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST